Analysis
-
max time kernel
130s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
03-07-2022 17:12
Static task
static1
Behavioral task
behavioral1
Sample
3b3a6ce0161991703ab6ff28e4b22e5934550f4c5573dcf61d1ed6a7e31253cd.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
3b3a6ce0161991703ab6ff28e4b22e5934550f4c5573dcf61d1ed6a7e31253cd.exe
Resource
win10v2004-20220414-en
General
-
Target
3b3a6ce0161991703ab6ff28e4b22e5934550f4c5573dcf61d1ed6a7e31253cd.exe
-
Size
316KB
-
MD5
1ec4a26ad4d59b67be78e29ba18a7fcd
-
SHA1
ba1b8f9b3797628c726f18386be009b28f0976b3
-
SHA256
3b3a6ce0161991703ab6ff28e4b22e5934550f4c5573dcf61d1ed6a7e31253cd
-
SHA512
2c990d90f804716ede668c4816b0a1661b4d0db4182a54c1a61727f8ff7fa8bdc23b3df79d543d0611fdf91a0c2c070fce2d5824a905d958c594e5abee13728c
Malware Config
Extracted
azorult
http://89.33.246.103/Panel/index.php
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Executes dropped EXE 1 IoCs
Processes:
app.exepid process 604 app.exe -
Drops startup file 2 IoCs
Processes:
cmd.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.exe cmd.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.exe cmd.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 1388 cmd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
app.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Run\Application = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\app.exe -boot" app.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
app.exedescription pid process target process PID 604 set thread context of 964 604 app.exe RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
3b3a6ce0161991703ab6ff28e4b22e5934550f4c5573dcf61d1ed6a7e31253cd.exeapp.exedescription pid process Token: SeDebugPrivilege 1280 3b3a6ce0161991703ab6ff28e4b22e5934550f4c5573dcf61d1ed6a7e31253cd.exe Token: SeDebugPrivilege 604 app.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
3b3a6ce0161991703ab6ff28e4b22e5934550f4c5573dcf61d1ed6a7e31253cd.execmd.exeapp.exedescription pid process target process PID 1280 wrote to memory of 772 1280 3b3a6ce0161991703ab6ff28e4b22e5934550f4c5573dcf61d1ed6a7e31253cd.exe cmd.exe PID 1280 wrote to memory of 772 1280 3b3a6ce0161991703ab6ff28e4b22e5934550f4c5573dcf61d1ed6a7e31253cd.exe cmd.exe PID 1280 wrote to memory of 772 1280 3b3a6ce0161991703ab6ff28e4b22e5934550f4c5573dcf61d1ed6a7e31253cd.exe cmd.exe PID 1280 wrote to memory of 772 1280 3b3a6ce0161991703ab6ff28e4b22e5934550f4c5573dcf61d1ed6a7e31253cd.exe cmd.exe PID 1280 wrote to memory of 1388 1280 3b3a6ce0161991703ab6ff28e4b22e5934550f4c5573dcf61d1ed6a7e31253cd.exe cmd.exe PID 1280 wrote to memory of 1388 1280 3b3a6ce0161991703ab6ff28e4b22e5934550f4c5573dcf61d1ed6a7e31253cd.exe cmd.exe PID 1280 wrote to memory of 1388 1280 3b3a6ce0161991703ab6ff28e4b22e5934550f4c5573dcf61d1ed6a7e31253cd.exe cmd.exe PID 1280 wrote to memory of 1388 1280 3b3a6ce0161991703ab6ff28e4b22e5934550f4c5573dcf61d1ed6a7e31253cd.exe cmd.exe PID 1388 wrote to memory of 604 1388 cmd.exe app.exe PID 1388 wrote to memory of 604 1388 cmd.exe app.exe PID 1388 wrote to memory of 604 1388 cmd.exe app.exe PID 1388 wrote to memory of 604 1388 cmd.exe app.exe PID 604 wrote to memory of 964 604 app.exe RegAsm.exe PID 604 wrote to memory of 964 604 app.exe RegAsm.exe PID 604 wrote to memory of 964 604 app.exe RegAsm.exe PID 604 wrote to memory of 964 604 app.exe RegAsm.exe PID 604 wrote to memory of 964 604 app.exe RegAsm.exe PID 604 wrote to memory of 964 604 app.exe RegAsm.exe PID 604 wrote to memory of 964 604 app.exe RegAsm.exe PID 604 wrote to memory of 964 604 app.exe RegAsm.exe PID 604 wrote to memory of 964 604 app.exe RegAsm.exe PID 604 wrote to memory of 964 604 app.exe RegAsm.exe PID 604 wrote to memory of 964 604 app.exe RegAsm.exe PID 604 wrote to memory of 964 604 app.exe RegAsm.exe PID 604 wrote to memory of 964 604 app.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3b3a6ce0161991703ab6ff28e4b22e5934550f4c5573dcf61d1ed6a7e31253cd.exe"C:\Users\Admin\AppData\Local\Temp\3b3a6ce0161991703ab6ff28e4b22e5934550f4c5573dcf61d1ed6a7e31253cd.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\3b3a6ce0161991703ab6ff28e4b22e5934550f4c5573dcf61d1ed6a7e31253cd.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.exe"2⤵
- Drops startup file
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c, "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.exeFilesize
316KB
MD51ec4a26ad4d59b67be78e29ba18a7fcd
SHA1ba1b8f9b3797628c726f18386be009b28f0976b3
SHA2563b3a6ce0161991703ab6ff28e4b22e5934550f4c5573dcf61d1ed6a7e31253cd
SHA5122c990d90f804716ede668c4816b0a1661b4d0db4182a54c1a61727f8ff7fa8bdc23b3df79d543d0611fdf91a0c2c070fce2d5824a905d958c594e5abee13728c
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.exeFilesize
316KB
MD51ec4a26ad4d59b67be78e29ba18a7fcd
SHA1ba1b8f9b3797628c726f18386be009b28f0976b3
SHA2563b3a6ce0161991703ab6ff28e4b22e5934550f4c5573dcf61d1ed6a7e31253cd
SHA5122c990d90f804716ede668c4816b0a1661b4d0db4182a54c1a61727f8ff7fa8bdc23b3df79d543d0611fdf91a0c2c070fce2d5824a905d958c594e5abee13728c
-
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.exeFilesize
316KB
MD51ec4a26ad4d59b67be78e29ba18a7fcd
SHA1ba1b8f9b3797628c726f18386be009b28f0976b3
SHA2563b3a6ce0161991703ab6ff28e4b22e5934550f4c5573dcf61d1ed6a7e31253cd
SHA5122c990d90f804716ede668c4816b0a1661b4d0db4182a54c1a61727f8ff7fa8bdc23b3df79d543d0611fdf91a0c2c070fce2d5824a905d958c594e5abee13728c
-
memory/604-65-0x0000000000370000-0x00000000003C8000-memory.dmpFilesize
352KB
-
memory/604-63-0x0000000000000000-mapping.dmp
-
memory/772-59-0x0000000000000000-mapping.dmp
-
memory/964-76-0x0000000000090000-0x00000000000B0000-memory.dmpFilesize
128KB
-
memory/964-78-0x0000000000090000-0x00000000000B0000-memory.dmpFilesize
128KB
-
memory/964-90-0x0000000000090000-0x00000000000B0000-memory.dmpFilesize
128KB
-
memory/964-92-0x0000000000090000-0x00000000000B0000-memory.dmpFilesize
128KB
-
memory/964-88-0x0000000000090000-0x00000000000B0000-memory.dmpFilesize
128KB
-
memory/964-86-0x0000000000090000-0x00000000000B0000-memory.dmpFilesize
128KB
-
memory/964-67-0x0000000000090000-0x00000000000B0000-memory.dmpFilesize
128KB
-
memory/964-68-0x0000000000090000-0x00000000000B0000-memory.dmpFilesize
128KB
-
memory/964-71-0x0000000000090000-0x00000000000B0000-memory.dmpFilesize
128KB
-
memory/964-70-0x0000000000090000-0x00000000000B0000-memory.dmpFilesize
128KB
-
memory/964-72-0x0000000000090000-0x00000000000B0000-memory.dmpFilesize
128KB
-
memory/964-75-0x000000000041A1F8-mapping.dmp
-
memory/964-84-0x0000000000090000-0x00000000000B0000-memory.dmpFilesize
128KB
-
memory/964-81-0x0000000000090000-0x00000000000B0000-memory.dmpFilesize
128KB
-
memory/1280-54-0x0000000001220000-0x0000000001278000-memory.dmpFilesize
352KB
-
memory/1280-55-0x00000000005B0000-0x00000000005D8000-memory.dmpFilesize
160KB
-
memory/1280-56-0x0000000000790000-0x00000000007B0000-memory.dmpFilesize
128KB
-
memory/1280-57-0x00000000005E0000-0x00000000005EC000-memory.dmpFilesize
48KB
-
memory/1280-58-0x00000000756E1000-0x00000000756E3000-memory.dmpFilesize
8KB
-
memory/1388-60-0x0000000000000000-mapping.dmp